Cyber criminals demand $3 million in ransom from Travelex after infecting its network with Sodinokibi ransomware

clock • 3 min read

Attackers claim to have copied more than 5GB of users' personal data

Cyber criminals are demanding a $3 million ransom from foreign currency exchange firm Travelex after penetrating its network and encrypting its network with Sodinokibi ransomware.

The news comes after it was revealed that Travelex had been warned that it was running vulnerable Pulse Secure virtual private networking (VPN) servers. However, it's unclear whether the company responded to the warnings from both security researchers and the National Computer Security Centre (NCSC). 

That's according to BleepingComputer, which claims that the attackers sent the ransom note to the company after copying more than 5GB of users' personal data - including their social security numbers, dates of birth, payment card information and other details - from the company's systems.

The attackers sent the ransom note to the company after copying more than 5GB of users' personal data

The Sodinokibi 'crew' told BleepingComputer that they had encrypted the entire Travelex network and would release users' data into the public domain if the company failed to pay the ransom in seven days.

The Sodinokibi ransomware, which the attackers used to encrypt Travelex's systems, was first discovered in April last year. At that time, it was found that the attackers were exploiting a flaw in Oracle Weblogic to spread the ransomware.

Sodinokibi, also known as Sodin and REvil, is known to typically add random extensions to files encrypted on computer systems. In Travelex's case, the encrypted files were also found to have extensions comprising more than five random characters.

The malware struck Travelex's network on 31st December, and left some readme documents on infected computers after encrypting critical business files.

The company then decided to take all of its computer systems offline in order to secure users' data and to prevent further spread of the virus.

The attack crippled Travelex services, leaving customers unable to use the app or website to make payments using debit or credit cards at more than 1,500 Travelex stores worldwide.

The company claimed that no customer data has been compromised as a result of the breach, but refrained from providing more details about the attack. It's not known whether the breach has been reported to the Information Commissioner's Office (ICO). 

Travelex has been forced to revert to manual procedures in its branches across the world as a result of the attack and electronic services, such as its pre-paid foreign currency cards, cannot be refreshed with new funds. 

The data breach has also disrupted foreign exchange services at several banks, including Barclays, HSBC, Sainsbury's Bank, First Direct, Virgin Money, and others, which rely on Travelex to provide those services.

According to security experts, Travelex took more than eight months to patch Pulse Secure virtual private networking (VPN) software containing a critical security vulnerability, leaving its computer systems vulnerable to cyber attacks.

Chicago, Illinois-based security researcher Troy Mursch said he had warned Travelex about insecure VPN servers in September 2019 - but that warning was probably ignored by the company.

Travelex was one of a number of companies that Mursch informed. Mursch said he had also notified the UK's National Cyber Security Centre about organisations running insecure servers, following which, the NCSC also sent out warning letters to all affected organisations.

Computing's coverage of the Travelex ransomware outbreak

You may also like
NCSC and insurers unite to fight ransomware threat

Threats and Risks

First rule: 'Don't panic'

clock 15 May 2024 • 3 min read
Cybersecurity Festival 2024: Four ways to cut your cyber insurance premiums

Finance

Certifications mean nothing without action

clock 08 May 2024 • 4 min read
LockBit leader unmasked

Hacking

Named as Russian national Dmitry Khoroshev

clock 08 May 2024 • 3 min read

Sign up to our newsletter

The best news, stories, features and photos from the day in one perfectly formed email.

More on Hacking

MoD hack: IT contractor concealed major hack for months

MoD hack: IT contractor concealed major hack for months

SSCL was reportedly awarded a contract worth over £500,000 in April, despite the breach occurring weeks earlier

clock 13 May 2024 • 2 min read
Dell confirms data breach affecting 49m people

Dell confirms data breach affecting 49m people

No financial info stolen, but names and addresses were leaked

clock 10 May 2024 • 2 min read
LockBit leader unmasked

LockBit leader unmasked

Named as Russian national Dmitry Khoroshev

clock 08 May 2024 • 3 min read